NetSight
IP …
medium6.0Public exploit code

CVE-2013-2113

The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by (1) changing the admin flag or (2) assigning an arbitrary role.

Affected products

VendorProductAffected versions
RedhatOpenstack
Version 3.0
TheforemanForeman
through 1.2.0
Version 1.1

Weakness classification

CWE-264

References